7050dfa5be8589bbbb1c5f58177028c659c71b58118e6f34cbf4b87305ccb28c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 09:42

Target

8ed39ddff6c207da2423820636a9541c.dll
Size

44KB
MD5

8ed39ddff6c207da2423820636a9541c
SHA1

829b980d45adea0edaa94f7c9b93a6fa39bb2be5
SHA256

7050dfa5be8589bbbb1c5f58177028c659c71b58118e6f34cbf4b87305ccb28c
SHA512

10314a4b62457f0d14518f55cbe33bc1a404c47a82134ae0d12640608cc0804d54d2afd9b81683f85d1fcc12c73838c63e75eaeed96ffade0d87f27f7251687f
SSDEEP

768:EkZ+AsIIpkavz7SHPX6wTybQnElIlgLa1c:LZ+qY7QXdyckLaK

Score

1^/10

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
804	Rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
804	Rundll32.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 2264 wrote to memory of 1676	2264	regsvr32.exe	28
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29
PID 1676 wrote to memory of 804	1676	regsvr32.exe	29

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\SysWOW64\Rundll32.exe
    C:\Windows\system32\Rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ed39ddff6c207da2423820636a9541c.dll,DllUnregisterServer
    3⤵
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:804